Markdown Parsers Don't Stop XSS Attacks — Sanitization Is a Separate Step

·1 views

Developers often assume a correctly functioning Markdown parser is sufficient protection against cross-site scripting (XSS), but parsing and sanitization are two distinct responsibilities. A Markdown parser determines what input means and converts it to HTML, while a sanitizer like DOMPurify enforces an allow-list of what that HTML is permitted to contain. Testing with Node.js, Marked, DOMPurify, and jsdom showed that valid parsed output can still carry dangerous event attributes, javascript: URL schemes, and DOM-clobbering name attributes unless explicitly stripped. Sanitization must occur after all HTML-transforming steps, since later plugins can reintroduce unsafe properties that an earlier sanitizer already removed. Security best practices recommend disabling raw HTML in Markdown where unnecessary, pinning sanitizer versions, and treating all externally sourced Markdown as untrusted by default.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How FinTech Dashboards Should Track Transaction State Beyond API Health

A technical guide published on DEV Community argues that transaction monitoring in FinTech must go beyond standard API metrics like latency and error rates. The article explains that a healthy API response does not confirm that money has moved correctly, as transactions can remain pending or ledger records may conflict with processor states. Effective dashboards should surface completion rates, pending transaction age, reconciliation gaps, callback freshness, and affected customers or merchants. The piece also warns that idempotency keys reduce retry risks but do not automatically protect downstream processes like ledger updates or refunds. The central goal, the author states, is ensuring every transaction has reached its correct authoritative state and that operations teams can investigate those that have not.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer shares three fixes for connecting AI agents to accurate financial data

A developer building AI assistants for financial use cases documented three critical failures encountered when connecting language models to tax and financial data. The first problem was that raw LLMs answered tax queries from outdated training data without signalling uncertainty, which was resolved by using Model Context Protocol (MCP) to fetch figures from a live tax server at query time. A second issue emerged when tool call failures were silent, allowing the model to improvise answers that looked identical to verified ones; the fix was requiring every returned value to carry a source authority and a verification date. A third problem arose when the AI assistant and a separate web calculator drew from different rate tables and returned conflicting figures for the same salary. The developer's solution was to route both surfaces through a single underlying data engine, eliminating the risk of tables falling out of sync.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Notion Launches AI Agents, Workers Runtime, and External Agent Support in 2026

Notion has repositioned itself in 2026 from a document and database tool into an AI-powered workspace layer where agents can read data, write files, and complete tasks. The company launched Custom Agents in February 2026, with users building over one million agents, though early versions lacked external connectivity and custom logic. On May 13, 2026, Notion introduced a developer platform featuring Workers, a hosted sandboxed runtime enabling custom code, webhook triggers, and live database sync from tools like Salesforce, Zendesk, and Postgres. A subsequent release on July 1, 2026 added External Agents, allowing teams to integrate AI models from Claude, Cursor, Codex, and Decagon directly within the shared workspace. All features are currently live and free to try on Business and Enterprise plans, though Workers remains in beta.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Node.js CLI to Compare Keyword Metrics Across Multiple Countries

A developer shared how building a command-line keyword research tool in Node.js reshaped their understanding of SEO data across different markets. The tool fetches metrics like search volume, CPC, organic difficulty, and ads competition for a given keyword across multiple countries simultaneously. Rather than treating these metrics in isolation, the approach layers them together to surface more meaningful insights, such as high CPC paired with low organic difficulty. The project also highlights how volume distribution across countries can reveal whether a keyword is a true global opportunity or concentrated in a single market. Custom filtering logic is central to the tool, allowing thresholds to be adjusted based on business type, whether B2B SaaS, local, or affiliate.

0 comments Read more at DEV Community